MalwarePublished 14 Jul 2026Updated 24 Sep 2026

fastify-bundler (npm) · Malicious Code

Affects fastify-bundlerSource GCVE Database

Malicious package : remove fastify-bundler and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10520

What to do

Remove fastify-bundler from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmfastify-bundler	Affected 1.4.13 – 1.4.16 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'fastify-bundler' version 1.4.13 contains malicious code that executes attacker-controlled JavaScript with full Node.js privileges. It fetches remote code from an external URL and runs it dynamically, enabling arbitrary code execution. The package also includes deceptive metadata to attract installs and dependencies that facilitate credential theft and command-and-control operations. Any system with this package installed should be considered fully compromised.

Impact

Systems with 'fastify-bundler' version 1.4.13 installed are fully compromised due to remote code execution with full Node.js privileges. Attackers can execute arbitrary code, steal credentials, perform host fingerprinting, and establish command-and-control channels. All secrets and keys on affected systems should be considered compromised and rotated immediately. Removal of the package does not guarantee full remediation as the attacker may have installed additional malicious software.

Defensive guidance

Remove the 'fastify-bundler' package immediately from all affected systems. Rotate all secrets, credentials, and keys from a secure, uncompromised environment. Because the attacker may have persistent access beyond the package, conduct a thorough investigation and remediation of the affected systems. Avoid installing packages with suspicious or inconsistent metadata.

Summary

The 'fastify-bundler' npm package (version 1.4.13) exports a function that fetches JSON data from a remote URL and executes the 'data.credits' field as JavaScript code using the Function constructor with Node.js globals bound. This allows an attacker to run arbitrary code with full privileges on the host system. The package's dependencies include modules for decrypting Windows credentials, accessing browser login data, host fingerprinting, and network communication, which can be leveraged for credential theft and command-and-control. The package uses deceptive naming and README content to mislead users into installing it, targeting multiple popular ecosystems.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 15:49 UTC

Technical details

References

Community reviews